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In device- independent quantum key distribution (DIQKD), the violation of a Bell inequality is 
exploited to establish a shared key that is secure independently of the internal workings of the 
QKD devices. An experimental implementation of DIQKD, however, is still awaited, since hitherto 
all optical Bell tests are subject to the detection loophole, making the protocol unsecured. In 
particular, photon losses in the quantum channel represent a fundamental limitation for DIQKD. 
Here, we introduce a heralded qubit amplifier based on single-photon sources and linear optics that 
provides a realistic solution to overcome the problem of channel losses in Bell tests. 



Bell inequalities had an enormous impact on the foun- 
dations of quantum physics [Ij. Interestingly, they also 
find application in Device-Independent Quantum Key 
Distribution (DIQKD) [2H5]: as their violation guaran- 
tees the presence of entanglement independently of what 
precisely is measured, they can be exploited to establish 
a secret key between two black boxes without the neces- 
sity to know anything about how the boxes operate (see 
Figure 1). 

An experimental demonstration of DIQKD, however, is 
still awaited. Indeed, all optical tests of Bell's inequality 
suffer from the detection loophole not all entangled 
photons are detected, because of unavoidable losses in 
the quantum channel, losses in the coupling between the 
photon-pair source and the optical fibers, and because of 
finite detector efficiency. The usual way out in Bell tests 
consists in assuming that the set of detected photon pairs 
is a fair set (the fair sampling assumption). It is indeed 
reasonable to assume that Nature is not malicious and 
does not trick us. But the situation is completely differ- 
ent in DIQKD. Here one does not test Nature, but fights 
against a possible active adversary [101 E]: it would 
make no sense to assume that the eavesdropper is not 
malicious. Missed events could be used to perform sim- 
ple and powerful attacks, e.g. the eavesdropper could 
force the black boxes to produce results only if the set- 
tings of the measuring devices are in agreement with a 
predeterminate scheme. Closing the detection loophole 
in an optical experiment is therefore a requirement for a 
demonstration of DIQKD. 

The detection efficiency, the product of the transmis- 
sion efficiency (including the coupling into the fiber) and 
the photon-detector efficiency, required to rule out at- 
tacks based on the detection loophole is very high, typ- 
ically larger than 82.8% for the CHSH inequality in 
the absence of other limitations. However, even assum- 
ing perfect photo-detection and lossless components, the 
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FIG. 1: Principle of DIQKD. Alice and Bob repeatedly choose 
inputs X and y for their QKD devices and obtain outputs a 
and b. The inputs can be thought of as measurements on 
entangled particles, and the outputs as the measurement out- 
comes. At the end of the protocol, Alice and Bob use an au- 
thenticated public channel to compare a sample of their data 
in order to estimate the conditional probability distribution 
P(a,b\x,y). If P{a,b\x,y) violates the CHSH-Bell inequality 
by a sufficient amount, then Alice and Bob can use standard 
error correction and privacy amplification to distill a secret 
key out of the remaining data. To establish security nothing 
has to be known or assumed about Alice's and Bob's black 
boxes, except that they can be described by quantum physics. 
Note, however, that it is assumed that Alice and Bob are each 
located in a secure place and control the information going in 
and out of their locations (dotted lines). In particular, the 
value of the inputs x, y and of the outputs a, b should not 
leak out unwillingly of Alice's and Bob's secure place. This is 
the only part of the protocol that cannot be untrusted: Alice 
and Bob should either enforce these conditions (e.g., by clos- 
ing a "door") or test it (e.g., by monitoring the output signals 
of the boxes). 



transmission efficiency of a 5 km long optical-fiber at tele- 
com wavelength is roughly of 80%. Transmission losses 
thus represent a fundamental limitation for the realiza- 
tion of a detection-loophole free Bell test on any distance 
relevant for QKD. 

The problem of transmission losses might be circum- 
vented by performing quantum-non-demolition measure- 
ments of the incoming photon or by using quantum re- 
peaters to distribute entanglement over large distances 
[12j in a heralded way. Here, we propose a much simpler 
scheme based on heralded qubit amplification that com- 
bines single-photon sources and linear optical elements 
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only. Our proposal could be implemented with present- 
day technology. It provides a realistic avenue towards 
device-independent quantum cryptography. 

Heralded qubit amplifier. Recently Ralph and Lund 
proposed a clever use of quantum teleportation to realize 
a heralded single-photon amplifier [T3]. Their scheme, 
presented in Fig. 2. a), has already motivated several ex- 
periments [Mj [T^ . We show how it can be extended for 
polarization-qubit amplification and we describe how this 
can be used in long-distance Bell experiments. 

We consider a (normalized) coherent superposition 

^in = a|0) -f (Phinl + P^inl^ |0) 

of a vacuum component and of a qubit corresponding 
to a single photon either horizontally (corresponding to 
the creation operator m|j or vertically polarized (asso- 
ciated to mJ,). This state enters the device presented 
in Fig. 2.b). Two auxiliary photons, one horizontally 
\lh) polarized and the other one vertically polar- 
ized, are sent through a beamsplitter with transmission t. 

This leads to the entanglement — icj^ + \/t out]^ ® 

(Vl — tc[ + \/t out\^ |0) of modes c and out. The modes 
Ch^v and in^y are then combined on a 50/50 beam- 
splitter. The modes after this beamsplitter are dh = 
{ch+inh)/\f^, dh = {ch - iuh) / d^ = {c^ + iuy) / ^/2, 
and dt, = (c^ — in^')l\f2. The detection of two photons 
with orthogonal polarization, for example, one in mode 
d^, the other one in mode d^,, projects the output mode 
into 



^/V^ta\G) + [^h^n\ -f /?,mj;) |0) 



For i = 1/2, the output state is equal to the input state 
and the scheme reduces to a teleportation protocol for 
qutrits with a partial Bell state analyzer. But for t > 1/2, 
the relative weight of the vacuum component decreases, 
leading to the amplification of the polarization-qubit. 
This qubit amplification is probabilistic, since it depends 
on the accomplishment of the Bell measurement, but it is 
heralded by two detector clicks. The success probability 
is given by IV-'outP- Since the detection of two-photons 
in modes {dh,d^), {dh,dy), or {dh,dh) combined with the 
appropriate one-qubit rotation also collapses the outcom- 
ing state into ipout, the overall success probability of the 
heralding amphfier is given by 4|V'o«tP- 

Application to DIQKD. As all teleportation proto- 
cols, the qubit amplifier also applies to mixed states. 
This provides a powerful tool to overcome the problem 
of losses in the frame of DIQKD. Suppose that a photon- 
pair source located on Alice's side is excited and can emit 
entangled photons with a small probability p ^ 1, lead- 
ing to the state 
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FIG. 2: a) Heralded amplifier for single photons as pro- 
posed in Ref. [131. A beam splitter with transmission co- 
efficient t turns an incoming photon into the entanglement 
of modes c and out which can be used to teleport an ar- 
bitrary state a|0) -I- /3m^|0} with the help of a partial Bell 
state analyzer. If f = |, this is standard quantum telepor- 
tation, i.e. the outcoming state a|0) ± Pout^\Q) is similar to 
the incoming one, up to a possible unitary transformation 
depending on which detector clicked. But ii t > |, a suc- 
cessful Bell state measurement projects the outcoming state 
in the incoming one but shifted towards the single-photon 
state y/1 - ta\Q) ± Vt/3int|0). b) Setup for amplifying 
polarization qubits in a heralded way. This scheme is simi- 
lar to the single-photon amplifier except that a product state 
of two photons with orthogonal polarization are sent through 
the partial beamsplitter. The probabilistic Bell measurement 
is based on a 50-50 beamsplitter followed by polarization 
measurements in the h/v basis (which require a polarization 
beamsplitter and two photodetectors). For f = |, a success- 
ful Bell measurement teleports an arbitrary qutrit of the form 
a\Q) + {Phin\ + l5^inl)\Q). For t > 1/2, the teleported state 

\/l — ta\0) + \Jt ^/3;iinj^ -|- fi^inC^ |0) has a smaller vacuum 
component leading to the heralded amplification of the qubit 
state. 



The term O(p^) introduces errors in the protocol, leading 
to the requirement that p has to be kept small. The mode 
h is sent to Bob through a quantum channel and because 
of losses, Alice and Bob share the state 
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where r\t denotes the transmission efficiency of the quan- 
tum channel. Before Bob performs measurements, he 
amplifies the modes and 6„ using the setup described 
in Fig. [3] The state resulting from the successful ampli- 
fication of both polarization modes is given by 



(l-tf 



(3) 
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FIG. 3: Proposed setup for the implementation of DIQKD 
based on a heralded qubit amplifier. The entangled-photon 
source is located close to Alice's location. Each of Alice's and 
Bob's black boxes includes a measurement apparatus. Fur- 
thermore, Bob's box contains the qubit amplifier which gives 
an heralding signal each time an entangled pair has been suc- 
cessfully distributed. Since Bob performs a measurement or, 
in other words, inputs a y, only when he got the heralding 
signal, Alice and Bob can safely discard all events where a 
photon got lost in the quantum channel. Note that the detec- 
tors can be either out or in the boxes depending on whether 
they can be trusted or not. In the figure, they are outside the 
black boxes. 

t{l - t)prit ajbl + ajbl ^ ajbl + ajbl 
4 I V2 ^/2 

For large enough t, the entangled component is amplified 
in a heralded way, offering the possibility for Alice and 
Bob to share a maximally entangled state despite losses. 
This promises a considerable advance towards the im- 
plementation of DIQKD on meaningful distances. The 
heralding signal from the amplifier allows Bob to intro- 
duce an input y in his black box only when he shares an 
entangled state with Alice. Hence, the overall detection 
efficiency required to close the detection loophole does 
not depend anymore on the transmission efficiency, but 
reduces to the intrinsic detection efficiency of Alice's and 
Bob's boxes. 

The probability to obtain a heralded signal is 

Ph = il-tf+pil-tf{l-Vt)+til-t)pTjt (4) 

which roughly reduces to (1 — i)^ for small transmission 
efficiency. As can be seen from Eqs. ^ and Q, there is 
a tradeoff on the transmission coefficient t of the partial 
beamsplitter. The amplification of the entangled com- 
ponent favors t w 1, whereas a high success probability 
favors t Ri 0. In order to rule out attacks based on the 
detection loophole, it is essential to choose a large trans- 
mission coefficient t « 1 to guarantee the distribution 
of highly entangled states. The price to pay is a reduc- 
tion in the key rate because of the limited success prob- 
ability of the qubit amplifier. Note that the problem of 
transmission losses cannot be overcome using a standard 
quantum relay implemented with two remote stochastic 



photon-pair sources and a Bell measurement made with 
linear optical elements and photon detectors. Indeed, 
without post-selection, a standard quantum relay allows 
only Alice and Bob to share a poorly entangled state due 
to multi-pair emissions. 

Implementation and performance analysis. In prac- 
tice, photons get lost not only because of the transmis- 
sion losses in the quantum channel but also because of 
the imperfect coupling of photons into the optical fibers, 
which is characterized by an efficiency rj^- On Bob's side, 
the coupling loss can be counter-balanced by the ampli- 
fier, as the transmission losses. However, the amplifier 
itself contributes a factor rjc back to the detection effi- 
ciency of Bob's box since the single-photon sources used 
in the amplifier must themselves be coupled into fibers. 
Hence, the overall detection efficiency required to close 
the detection loophole reduces to the product of the cou- 
pling efficiency r]c by the detector efficiency rjd, but does 
not depend anymore on the transmission efficiency rjt- 

We now perform a detailed analysis to assess the per- 
formance of our scheme where we consider two possibil- 
ities for the single-photon sources used in the amplifier: 
either on-demand or heralded sources. Note that the lat- 
ter can be realized from a pair-source where the emission 
of an individual photon is heralded by the detection of the 
twin-photon, as implemented in Ref. | 18j from the para- 
metric down conversion process. A single-photon source 
on-demand could then be obtained by adding a quantum 
memory. In the long run, on-demand sources based on 
quantum dots embedded in microcavities |16j or single 
atoms inside high-finesse cavities [17] are also potential 
candidates. 

We consider the DIQKD protocol based on the CHSH 
inequality analyzed in Existing security proofs valid 
against collective attacks, assume perfect detectors OE]. 
We show in Appendix I, how to apply them to the case 
of imperfect devices and how to compute the correspond- 
ing key rate. Moving slightly away from a full device- 
independent scenario, we also consider the case where the 
end detectors are trusted and can be moved out of the 
black boxes. This means that the detectors are well char- 
acterized, have a known efficiency, and that the eaves- 
dropper cannot tamper with them. In this case, a Bell 
violation can be observed independently of the detector 
efficiency rjd and any local description is ruled out pro- 
vided that the coupling rjc of single-photons into optical 
fibers is high enough. 

To compute the key rate, we consider a fiber attenua- 
tion of 0.2 dB/km, corresponding to telecom wavelength 
photons, and a coupling efficiency of rjc = 0.9. The cou- 
pling efficiency of single-photons within optical fibers is 
being maximized in many laboratories and a coupling of 
83% was reported in jl8|. We assume that the photon- 
sources are excited with a repetition rate of 10 Ghz |19j . 
We take all detectors to be photon-number resolving de- 
tectors with efficiency rjd and we neglect dark counts. 
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FIG. 4: Key rate vs distance for DIQKD with imperfect de- 
vices (log-log scale). (Red) curves labelled a) correspond to 
untrusted detectors of efficiency rjd = 0.95 (seen as part of 
the QKD black boxes); (Blue) curves labelled b) correspond 
to trusted detectors of efficiency r)d = 0.8 (moved out of the 
QKD black boxes). The dotted vertical line represent the 
maximal distance above which no secret key can be extracted 
in the absence of an amplification process that counterbal- 
ances transmission losses. The two lower curves give the key 
rate (in bit/min) as a function of the distance for an ampli- 
fier based on heralded single-photon sources; the two upper 
curves represent the key rate (in bit/s) for an amplifier with 
on-demand single-photon sources. 



Note that superconducting transition-edge sensor detec- 
tors can already resolve telecom- wavelength photons and 
have 95% efficiency with negligible noise [2^. Since we 
consider realistic sources, e.g. based on parametric down- 
conversion to provide high repetition rates, the dominant 
errors come from the multi-pair emissions which have to 
be made small by controUing the intensity of pumping 
lasers, i.e. the parameter p for the entangled pair source 
and p' for the pair-source used to produce heralded single- 
photons. For a given distance, we optimized the trans- 
mission coefficient t and the pump dependent parameters 
p and p' to maximize the key rate, see Appendix II. The 
results of our calculations are presented in Figure 4 for 
untrusted detectors of efficiency rjd — 0.95 and for trusted 
detectors of efficiency rj^ — 0.8. 

In the absence of an amplification process, no secret 
key can be established beyond 1.4km for untrusted de- 
tectors and beyond 3.6km for trusted detectors. On the 
other hand, an implementation based on a qubit ampli- 
fier with heralded single-photon sources achieves rates 
of about Ibit/min on distances of 10-20km and rates of 
about Ibit/s on distances of 80-90km with on-demand 
single-photon sources. Note that contrarily to the situa- 
tion without the amplifier, there is in principle no limi- 
tations other than technical ones on these distances and 
they can be further extended, provided that one is willing 



to lower the key rate. 

Finally, note that the physics behind the qubit- 
amplification is based on the bosonic character of indis- 
tinguishable photons. The temporal, spectral, spacial 
and polarization properties of modes produced by the 
entangled-pair source and by the single-photon sources 
(the modes b and c involved in the Bell measurement, 
see Figure [s]) thus have to overlap. However, when the 
input state is an admixture between a qubit state and an 
empty component, as caused by losses, the optical path 
length does not require an interferometric control. The 
degree of indistinguishability of two photons is measured 
through the visibility V of the "Hong-Ou-Mandel" dip 
[22j . Reference [23] has reported a visibility V = 0.994, 
largely sufficient for the successful implementation of our 
scheme (see analysis in Supplementary Informations II). 

Conclusion. We have presented a simple qubit ampli- 
fication scheme suited to the distribution of entanglement 
over large distances in a heralded way. This scheme could 
find applications, e.g., in traditional QKD [21] or in the 
context of quantum repeaters |12| . Here, we show how to 
use it in DIQKD to overcome the problem of transmission 
losses. 

An implementation of our proposal with heralded 
single-photon sources represent an experiment feasible 
with today's best technology that demonstrates DIQKD 
over 10-20 km of standard telecom fibers. The experi- 
ment promises to be difficult, though every single step of 
the proposed experiment has already been demonstrated. 
We see our proposal as a great challenge for the quantum 
communication community. 
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the estimation of the CHSH quantity 

S = (ai&i) + (0162) + (a2&i) - (a2&2) , (6) 

where the correlator (aibj) is defined by P{ai — bj) — 
P{ai 7^ bj). The CHSH quantity bounds eavesdropper's 
information on the raw key and thus governs the pri- 
vacy amplification process. Under collective attacks ^ 
2], eavesdropper's information is bounded by 

WS)<.(5)^.(i±^^<fl!^), (7) 

where h{x) = — a;log2(a;) — (1 — a;) log2(l — is the binary 
entropy. 

The achievable key rate K after error-correction and 
privacy amplification is then given by 

K>l-h{Q)-lEiS) (8) 
Imperfect devices 



APPENDIX I: DIQKD WITH PHOTON LOSSES 

Existing security proofs of DIQKD assume devices that 
always produce a conclusive answer, e.g., a ±1 result [T]- 
[3] . Here we show how to apply them to the case of imper- 
fect devices (including the transmission losses, the detec- 
tor inefficiencies and the imperfect coupling of individual 
photons within optical fibers) and how to compute the 
corresponding key rate. We consider the DIQKD proto- 
col based on the CHSH inequality introduced in [4 and 
first remind the known results in the case of lossless de- 
vices. 



Lossless devices 

In the "2-1-3 bases" protocol introduced in Alice has 
three inputs x = {xo,xi,X2} and Bob two inputs y = 
{yi,y2}- All outputs a = {00,01,02} and b = {61, 62} 
take binary values oq, oi, 02, &i, 62 G {— Most of 
the time, Alice and Bob use the inputs x — xq and y — 
yi, and the raw key is extracted from the corresponding 
outputs oo and 61. The amount of correlations between 
Alice's and Bob's symbols is quantified by the quantum 
bit error rate (QBER) defined as 

g = P{ao ^ bi) . (5) 

This parameter is related to the amount of classical com- 
munication needed for error correction. 

The inputs Xi,X2,yi,y2 are used on a subset of the par- 
ticles to bound the eavesdropper's information through 



If the devices of Alice and Bob have non-unit detec- 
tion efficiency, the outputs a and 6 can take three val- 
ues {i, ±1} where i denotes an inconclusive result (the 
absence of a click). Let /ice denote the observed proba- 
bility of obtaining a conclusive result (±1) on each side; 
fici of obtaining a conclusive result on Alice's side and 
an inconclusive one on Bob's side; and /i^c of obtaining 
an inconclusive result on Alice's side and a conclusive 
one on Bob's side. Note that we assume for simplic- 
ity throughout the paper that the devices are such that 
ficcixy) = Hcc, Itciixy) = Hci, and Hidxy) = iiic for all 
inputs x,y, i.e. the observed probabilities for the devices 
to produce a conclusive result are the same for all inputs. 
Our analysis, however, can be generalized in a straight- 
forward way to more general cases. 

We assume that the QBER and the CHSH value are 
computed as in Eqs. ([s]) and ^ on the set of con- 
clusive results ±1 using the renormalized probabilities 
P{ai,bj)/ iicc- 

We consider the following possible strategies for the 
eavesdropper. Eve. Either she uses some quantum strat- 
egy q that will produce two conclusive results on each 
side with certainty. This arises with probability Pq and 
contributes by an amount Sq to the CHSH violation. In 
this case, Eve's information is bounded by /_E(g) < x{Sq) 
as determined in [51 13] . Or she uses a mixture g of "guess- 
ing" strategies where on each run at least one of the 
inputs X of Alice or y of Bob is assigned an inconclu- 
sive results. In this case, Eve may have full information, 
Isig) £ 1, and the CHSH violation (given that two con- 
clusive results have been obtained on each side) is Sg < 4. 

Let Pg be the proportion of events that arises from 
a mixture of guessing strategies and where both Alice 
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and Bob obtain a conclusive result. We thus have fic 
Pq + Pg. The observed CHSH violation is given by 



S = 



PqS^+PgSg . PaSa+m 

p„ 



< 



q^q 



and thus 



Sq > 



Pn 



f-^cc ^ g 

The information of Eve is bounded by 



(9) 



(10) 



Ie = 



< 



PglEiq) + PglEig) ^ PqXiSq) + P, 



P + P 



Pn 



/Mcc, (11) 



where we have used ( 10 1 to obtain the last inequality. 
Now note that 



Pg < Mc 



(12) 



since every guessing strategy that contributes to ficc con- 
tributes at least with the same weight to either fi^i or 
Hie (since the guessing strategies assign an inconclusive 
results to at least one of the inputs x of Alice or y of 



Bob). As the bound (11) is a monotonically increasing 
function of Pg, it is necessarily smaller than or equal to 
the solution with Pg = fid + fJ-ic- Writing 



Ate 



(13) 



we finally find that Eve's information is bounded by 

'5 -4m 



1-M 



(14) 



which only depends on the observable quantities 
S, jjLcc, fJ-ci, i^ic- Putting all together, the key rate per con- 
clusive event is given by [\ — h{Q) — Ie{S, fi)] and the key 
rate per use of the device is then 



(15) 



As an illustration, consider the case where fXcc — "H^, 
IJ^ci — ^J'ic — ?7(1 — v)j where rj is the detection efficiency 
of each box. The bound (TmI then becomes 



/ < 



(3.-2)x(^^^^^ 1+2(1-,) 



/V- (16) 



For the perfect singlet correlations satisfying Q ~ 0, S ^ 
2\/2, the key rate is positive as long as > 2/(1 + \/2) ~ 
0.8284 which corresponds to the threshold required to 
close the detection loophole with the CHSH inequality. 



Imperfect devices with trusted detectors 

If the detectors can be trusted, we can move them out 
of boxes. Instead of assuming that the boxes have clas- 
sical outputs ±1, we assume that they have two output 
channels, a "-I-1" channel and a " — 1" channel, from 
each of which N photons can be emitted. These photons 
may then produce clicks on trusted photon-number re- 
solving detectors characterized by a known efficiency, rj^. 
The eavesdropper can control how many photons out- 
put the boxes, but he cannot control whether they will 
be detected or not by the trusted detectors. The QKD 
black boxes are thus now characterized by the proba- 
bilities ^jk,im that j photons are emitted in Alice's -1-1 
channel, k in Alice's —1 channel, I in Bob's -1-1 channel, 
and m in Bob's —1 channel. 

As a starting point, let us assume that Alice and Bob 
have photon-number resolving detectors with unit effi- 
ciency, rjd ^ 1- In this case, Alice and Bob observe 
{jk,lm) clicks in their detectors only if the boxes sent 
{jk,lm) photons, i.e., Alice and Bob have direct infor- 
mation about the outcomes (jfc, Im) produced by the de- 
vices. We define the set of conclusive events as those 
where a unique photon is detected on each side. For in- 
stance, if Alice chooses the input xq and finds one photon 
in the +1 channel and no photon in the —1 channel, she 
associates to this event the output oq = -1-1. If there is 
no photon in the +1 channel and one in the —1 chan- 
nel, this corresponds to = — 1. All other possibilities, 
for instance no photons outputted by any channels or 2 
photons outputted by one of the channels, are consid- 
ered as inconclusive events, Og = i. As before the raw 
key and the parameters Q and S are defined on the sub- 
set of conclusive events. The situation is then formally 
equivalent to the one discussed in the previous section 
where the box can either produce conclusive or inconclu- 
sive events, which are unambiguously recognized as such 
by Alice and Bob. Eve's information is thus bounded by 



by (15) 



the expression ( 14 ) for /£;(S', fJ.) and the key rate is given 



If, on the other hand, Alice and Bob have photon- 
number resolving detectors with a finite efficiency jy^ < 1, 
they can no longer determine unambiguously the out- 
comes {jk, Im) generated by the devices. For instance, if 
Alice obtains one click in the -1-1 channel, this could either 
correspond to the event j = I where the unique produced 
photon has been detected or to an event j = 2 where one 
of generated photons did not give a click. The probabil- 
ities Sjk,im that Alice and Bob obtain (jk, Im) clicks can 
be easily computed from the probabilities "fj'k',i'm' that 
the boxes emit {j'k'J'm') photons using the fact that 
the probability to detect n photons when n' have been 
produces in a given channel is p„„/ = (J^^rj^il — %)" 

As before, we define the set of conclusive events as 
those where only one photon is detected and we denote 
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by /Zee the probability of finding two conclusive results 
on each side. We also introduce the notation 



710,10 + 710:01 + 701,10 + 701,01 



(17) 



for the probability that the devices produce a single pho- 
ton on each side. This quantity is identical to /^cc when 
the detectors have unit efficiency rjd — ^- Similarly, we 
introduce the notation 



(18) 



for the probability that the devices output a single pho- 
ton on Alice's side and strictly more or strictly less than 
one photon on Bob's side, and define analogously jjic- 
Again, these quantities reduce to fi^ and /ijc, respec- 
tively, when the detectors have unit efficiency, Ty^j = 1. 

A fraction "q^jicc/ fJ-cc of the raw key originates from 
events where a single photon has been produced by the 
boxes and has successfully been detected by Alice's and 
Bob's detector. This part of the raw key corresponds 
to the ideal situation discussed above when rj^ — 1. 
The information that Eve has on it, is thus bounded 
by lE{S,fi), where S is the CHSH violation conditional 
to the emission of one photon from each boxes and 
A = (Mcz + IMc)/lJ^cc is defined through the relations (17) 
and ( jlS] ) |10| . Note that even though Alice and Bob 
cannot know for each individual run exactly how many 
photons where sent by the boxes, i.e., which outcome 
(jk^lm) was precisely produced, they can nevertheless 
determine the probabilities 7 — {"/jk.im} characterizing 
the output of the devices from their observed detection 
statistics S — {Sj^^im}- This information is sufficient to 
determine in turn the parameters S and // above and thus 
to compute lE{S,fl). 

The remaining fraction 1 — Tj^jj-cc/ IJ^cc of the raw key 
originates from events where more than one photon are 
produced at each side, but only one was detected. In this 
case, we conservatively give to Eve all information about 
the outcomes. In total, Eve information is thus equal to 



lEiS)<-^lEiS,f:i)+{l-^ (19) 

which can be determined solely from the observed statis- 
tics d. Finally, taking into account the probability with 
which Alice and Bob observe a conclusive results, we find 
that the key rate is given by 



K>/iee [1 ~ h{Q) ~ lE{d)] 



(20) 



APPENDIX II: KEY RATE WITH A QUBIT 
AMPLIFIER IMPLEMENTATION 



Here, we detail the calculation of the achievable key 
rate when DIQKD is implemented with a heralded qubit 
amplifier. 



Single-photon sources 

The key rates have been estimated by considering var- 
ious resources. In particular, the single-photon sources 
required within the qubit amplifier can be either heralded 
or on-demand. 

Let us first focus on the implementation of a heralded 
single-photon source from a pair source based on the 
parametric down convertion (PDC) process. The state 
resulting from the PDC process is well approximated by 

|00)(00| +p'|ll)(ll| +y2|22)(22| +o(p'3). (21) 

p' is the probability for the successful emission of one 
pair. The first (second) Fock state gives the number of 
photons in the signal (idler) mode. The detection of one 
member of a pair can then be used to herald the pres- 
ence of the other. This provides a heralded single-photon 
source as required in the proposed qubit-amplifier. The 
probability for a detector that is photon number resolv- 
ing, but that has non-unit efficiency ijd, to detect a single 
photon in a predetermined mode, given that there are n 
photons present in that mode, is nr]d{l — ?7d)"~^. Hence, 
the state conditional on the detection of a single-photon 



|l)(l|+2p'(l-%)|2)(2|+o(p'2) 



(22) 



and the success probability for the heralding signal is 
Ps = p'Vd- 

Our proposal requires two heralded photons with 
orthogonal polarizations. In what follows, we focus 
on an implementation based on two separate crystals. 
Note that two heralded photons could be produced by a 
single non-linear crystal by selecting only the emissions 
of double pairs of photons. In other terms, the detection 
of two photons with orthogonal polarization in e.g. the 
"idler" mode heralds the production of the two desired 
photons in the signal mode. 

A single-photon source on-demand is more difficult to 
implement in practice but it provides a higher key rate 
than the one from a heralded single-photon source. For 
the first demonstration experiments, the most promis- 
ing approach may be the use of heralded single-photon 
source based on parametric down-conversion, as previ- 
ously described, combined with a quantum memory for 
light. In the long run, sources based on quantum dots [S] 
embedded in microcavities [S] are likely to offer higher 
repetition rates. Single atoms inside high-finesse cavi- 
ties [7] are also potential candidates. In our paper, the 
state generated by on-demand sources is assumed to be 
described by the Fock state |1) and to be produced with 
the probability P5 = 1. 
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State conditional to a successful amplification 

The evaluation of the achievable ket rate is based on 
the knowledge of the state that is shared by Alice and 
by Bob. In the ideal case where we take into account the 
transmission losses only, the state resulting from a suc- 
cessful amplification is given by the equation (2) of the 
main text. However, to properly assess the performance 
of our scheme, we take into account other imperfections 
in what follows. (Note that these imperfections are rep- 
resented schematically in Figure [5]) 

The starting point is the initial state which is the prod- 
uct of three states. The first one is associated to the 
stochastic emission of entangled photon-pairs at Alice's 
location where we now explicitly write the 0{p^) terms 
corresponding to double-pair emissions. The two others 
are associated to the single-photon emissions within the 
qubit amplifier, one horizontally polarized and one verti- 
cally polarized 



lh){lh\ + '2p'{l-r]d)\2h){2h\ 

-P\j^{4bi + albl)){j^{aibi + albl 



Bob Y 



+2p'(l-?7d)|2„)(2,, 



(If the single-photons are produced on-demand, the ini- 
tial state is similar but with p' = 0.) The modes pro- 
duced by the entangled-pair source, labelled a and 6, are 
each coupled into optical fibers with efficiency rjc. Al- 
ice performs measurement on the mode a. The mode b 
is sent to Bob's location using an optical fiber with the 
transmission efficiency 774. The photons emitted by the 
heralded sources located within the qubit amplifier, are 
coupled into optical fibers with efficiency r]c. Then, they 
are sent through a partial beamsplitter with transmis- 
sion t to form an entangled state involving the modes Ch, 
Cy, and the modes later on detected by Bob. The modes 
b and c are combined on a 50/50 beamsplitter to per- 
form a partial Bell state measurement based on photon 
detectors with non-unit efficiency rjd- 

From a perturbative calculation, i.e. keeping only the 
terms at the order o(p^), o{p'^) and o{pp'), we derived 
explicitly the state p resulting from a successful Bell mea- 
surement lllj . This mixed state has many components 



P 



Poo Poo + Poi Poi + Pio PlO 
+P11 Pu + P02 P02 + P20 P20 
+P12 P12 + P21 P21 + P22 P22 



(23) 



corresponding to different cases where Alice and Bob get 
each either zero, one or two photons. By summing the 
weights Pij of these components, one obtained the suc- 
cess probability for the heralded qubit amplification Pu- 



rid X 




FIG. 5: Proposed setup for the implementation of device- 
independent quantum key distribution based on heralded 
qubit amplification. Here, the photon sources are based on the 
parametric down conversion process. The entangled-photon 
source is located close to Alice's location. Two sources of 
heralded single-photons are located within the qubit ampli- 
fier at Bob's location. The photons are coupled into optical 
fibers with efliciency rjc- The detectors have non-unit efficien- 
cies given by rjd- The efficiency of the transmission line is 
labelled J?t. 



The renormalized weights Pij — Pij/Pn correspond to 
the probabilities that Alice gets i photons and that Bob 
gets j photons exactly, knowing that the amplification 
succeeded. 



Key rates for imperfect devices 

To compute the key rate, we consider a particular im- 
plementation of the "2-f 3 bases" protocol g] where Alice 
chooses to apply one out of three possible measurements 
Xq = 0-2, Xi = (cr^ + (Tx)/V2, X2 = {(Jz - crx)/V2 and 
where Bob chooses one measurement out of two, either 
2/1 — or 2/2 = o'x- This specific choice maximizes the 
CHSH polynomial when Alice and Bob share a maximally 
entangled state. 



Untrusted detectors 

We first consider the case where Alice's and Bob's de- 
tectors are untrusted and are thus a part of the QKD 
black-boxes. We follow the analysis reported in sub- 
section [] to obtain the secret key rate. We remind 
that a conclusive event corresponds to a single detec- 
tor click. The probabilities ficc, p-ci and fiic to ob- 
tain conclusive-conclusive, conclusive-inconclusive, and 
inconclusive-conclusive events, respectively, are functions 
of the probabilities Pij to have i photons on Alice's side 
and j photon on Bob's side, defined by 



Pc 



VdPii 



-2{l~rj,)7iiP2i 
ridfP22. 



Pr 



(24a) 
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mPw + ??<i(l - Vd)Pii + 277<j(l - %)^P2i 



% + (1 - 7?<i) Pl2 + 2T^d{l - Vd)P. 



20 



+ {2ril{\~'na)+2,ldil-Vd)^)P22 (24b) 
= %^oi + %(1 - r/dj^'ii + 2r?d(l - mfPi2 

+ u 



Vdil~Vd))P2i + 2r]dil-7]d)Po2 
+ {2rjj{l-7jd)+2rja{l-Vdf)P22. (24c) 
The QBER Q and the CHSH value S are given by 



T^jQn + 2(1 - Vd)v^iQ2i + Q12) + 4?7^(1 



Vd) Q22 

(25) 



and 

S = T]^^! 



-2(l-fid)VdiS2i + Si2)+Ar,l{l-r,a)^S22 (26) 



where Q^j and Sij represent the QBER and the CHSH 
values computed on the state PijPij/fJ.cc for the measure- 
ment settings x and y specified above. The key rate per 
conclusive event, given by [l—h{Q)—lE{S, /Li)] is obtained 
from Eve's information Ie{S, fj,) which is calculated from 
Eq. (14). Taking the success probability for the single- 



photon emission P5 and the success probability for the 
qubit amplification Ph into account, we deduce the key 
rate per second 



K ^ rx P^Ph X 
Mcc (1 - h{Q) 



(27) 



(1 - m)x 



1 



where r is the repetition rate of sources. Let us remind 
that when the qubit amplifier uses on-demand single- 
photon sources, P5 = 1. 



Trusted detectors 

We now consider the case where the detectors are 
trusted and moved out of the boxes. This corresponds 
to the analysis developed in subsection [j The raw key 
is formed as before on the set of conclusive events cor- 
responding to a single detector click on each side. The 
parameter and the QBER Q are thus given by ( 24a 



and (25) as before. However, the CHSH value S is now 



calculated on the state pn corresponding to a single pho- 
ton on each side. Finally, ji is defined from the following 
parameters 



Pc 
Ac 



^Pii, 

= PlQ + P12, 
= PqI + P21- 



The key rate per conclusive event is then given by [1 — 
h{Q)~- Ie{S)] where Eve's information Ie{S) is calculated 



from Eq. (19), and the key rate per second is given by 
K = rPlPHPcc (1 - KQ) - Ie{S))) 



where r is the repetition rate of sources, Ps is the suc- 
cess probability for the single-photon emission and Ph is 
the success probability for the qubit amplification. Let 
us remind again that when the qubit amplifier uses on- 
demand sources, Ps — 1- 



Requirements on the overall detection efficiency 

Let us roughly estimate the overall detection effi- 
ciency which is required to rule out attacks based on 
the detection loophole. If Bob's box contains a qubit 
amplifier and if the sources are weakly excited such 
that the double pair emissions can be neglected, we 
have P02 ~ P20 ~ P12 ~ P21 ~ -P22 ~ 0. Further- 
more, if the reflectivity of the beam-splitter located 
within the amplifier is weak enough, the conditional 
probability to distribute one photon at a given loca- 
tion is mainly determined by the coupling of single 
photons within an optical fiber ijc, i.e. Pn — rj^ and 
Pw + Poi = 2ric{l — rjc). Note that in this case, the 
state corresponding to the event where one photon is 
generated at each side pn is a pure maximally entangled 
state pii = (f>+ = l/V2{ahbh + avK). 

First, consider the case where the detectors are 
untrusted. The QBER, calculated from Eq. ([25|, 



reduces to zero since the correlations observed from a 
maximally entangled state are perfect. Eve's information 
Ie{S,p) is obtained from Eo- where the CHSH 

value, calculated from Eq. (26), is given by S' = 



and where the parameter p, (see Eq. (13)) is defined 
as /i = 2(1 — rjdric) / {rjdrjc) ■ One concludes that the 
difference of mutual informations 1 — h(Q) — Ie{S,p) 
is positive a s lo ng as the argument of x is greater than 
2 (see Eq. ([m])), i.e. if 77^77^ > 2/(1 + \/2) ~ 0.8284. 
Thus, the proposed protocol requires a minimum value 
for the product of the detector efficiency by the coupling 
efficiency (r/^r/c)™™ = 0.8284 which corresponds to the 
threshold required to close the detection loophole with 
the CHSH inequality. If this is satisfied, the distribution 
of a quantum key is made possible, independently of 
the proper functioning of the devices, for arbitrary 
long distances. Note that without qubit amplifier, 
rjdric has to be replaced by the product ^/rjtijdijc where 
r]t is the transmission efficiency of the optical fiber 
connecting Alice's and Bob's location. This means that 
for rid = 0.95 and rjc ~ 0.9, DIQKD is possible only for 
distances smaller than 1.4 km. 



In case where the detectors can be trusted, the 
QBER is unchanged and hold to zero but eavesdropper's 
information /_e(<5) has to be calculated from Eq. (19) 
which reduces to Ie{S,p,) since pcc = tldPcc- We find 
S — 2^/2 and p = 2(1 — Vc)/Vc so that any attacks 



(28) based on the detection loophole is ruled out as long as 
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the coupling efRciency is greater than ry™'" = 0.8284 
independently of the detection efficiency. We emphasize 
that without qubit amplifier, rjc has to be replaced by 
the product y^rj^ and for Ty^ — 0.9, Alice and Bob 
cannot exchange a secure key if the distance separating 
them is larger than 3.6 km. 



Performance of the proposed protocol 

Finally, let us detail how the achievable key rate is 
evaluated, first by focusing on the case where the de- 
tectors are untrusted. We fix the detector efiiciency 77^ 
and the coupling efRciency rjc- For a given distance, we 
optimize the success probability for the entangled-pair 
emission p and for the single-photon emission p', as well 
as the transmission of beam splitter located within the 



qubit amplifier t in order to maximize the key rate (27 1. 

Assume for concreteness r?c = 0.9 and 77^ = 0.95. For 
10 km, we found that the optimal success probability for 
entangled-pair emission and for single-photon emission 
are respectively p = 2 x 10"'^ and p' = 3 x 10"'^ and 
that the optimal transmission of the beam splitter lo- 
cated within the qubit amplifier \st k, 0.98. If the sources 
are excited with a repetition rate of 10 Ghz, this leads to 
a key rate of roughly 1 bit/min. If the required single- 
photons can be produced on-demand, one has Ps — 1 
and DIQKD can be performed over 90 km with a key 
rate of 0.1 bit/s. 

In case where the detectors are trusted, one has to 
maximize the formula (28). With rjc = 0.9, rjd = 0.8 
and for 10 km, the optimal values are p = 7 x 10^"^ 
and p' = 4 X 10^^ and t ^ 0.97. For a repetition 
rate of 10 Ghz, the achievable key rate is roughly of 7 
bits/min. If the single-photons are on-demand, a secret 
key can be transmitted over 90 km with a rate of 2 bits/s. 
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FIG. 6; Key rate vs distance for DIQKD (log-log scale) 
when the mode overlap is imperfect (V=0.994). (Red) curves 
labelled a) correspond to untrusted detectors of efficiency 
rid ~ 0.95; (Blue) curves labelled b) correspond to trusted 
detectors of efficiency rjd — 0.8. The dotted vertical line rep- 
resent the maximal distance above which no secret key can be 
extracted without qubit amplification. The two lower curves 
give the key rate (in bit/min) as a function of the distance for 
an amplifier based on heralded single-photon sources; the two 
upper curves represent the key rate (in bit/s) for an amplifier 
with on-demand single-photon sources. 



violation and thus the key rate. In Figure |6j we present 
the achievable key rate as a function of the distance for 
V — 0.994 corresponding to the visibility reported in 
Ref. One sees in comparison with the result of the 
Figure 4 (main text) that the key rate is divided by a fac- 
tor of 3.5 in the case of untrusted detectors with heralded 
sources but is essentially unchanged in the case of trusted 
detectors with on-demand sources. In conclusion, small 
imperfections in the mode overlap do not dramatically 
change the performance of our protocol. 



Photon indistinguishabihty 

To herald the remote distribution of entanglement us- 
ing the qubit amplifier, the photons involved in the Bell 
measurement have to be indistinguishable. The degree of 
indistinguishabihty of two photons can be quantified by 
their mode overlap which corresponds experimentally to 
the visibility of the "Hong-Ou-Mandel" (HOM) dip [8]. 
We have estimated with a simple model based on discrete 
modes that partial overlaps lead to a phase noise on the 
heralded entanglement. Alice and Bob do not share the 
state (/)+ anymore but instead a state which has an ad- 
mixture of (/)_, i.e. F|(/)+)(0_|_| -I- (1 — F)\(j)-){(j}-\ where 
F = (1 + V^)/2. V is the HOM dip visibility which is 
supposed to be the same for the modes {b, c^}, {b, Cy}, or 
{ch,Cv}. This phase noise reduces potentially the CHSH 



Remarks on the quantum relays for DIQKD 

Note that a standard quantum relay made with 
SPDC sources is not an alternative solution for the 
implementation of device independent quantum key 
distribution. The central problem with a quantum relay 
comes from the multi-pair emission and this problem 
cannot be circumvented only by reducing the power of 
the pump injected in the nonlinear crystal. To mitigate 
the multi-pair problem in a standard quantum relay, it 
is necessary to post-select either the events where there 
is one detection at both ends of the chain (at each Bob's 
and Alice's locations) or the events where a predeter- 
mined detector located at one end of the chain (either at 
Alice's or Bob's location) clicks provided that the closest 
source is very weakly excited. Such a postselection is fine 
for standard QKD. However, postselections of that kind 
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is incompatible with DIQKD since they open inevitably 
the detection loophole. Our proposal fundamentally 
differs from a conventional quantum relay. It allows 
to distribute high-quality entanglement provided that 
the two photons required within our qubit amplifier are 
produced in a heralded way.x 



[1] A. Acin et al, Device-independent security of quantum 
cryptography against collective attacks. Phys. Rev. Lett. 
98, 230501 (2007). 

[2] S. Pironio et al., Device-independent quantum key distri- 
bution secure against collective attacks. New J. Physics 
11, 045021 (2009). 

[3] M. McKague, Device independent quantum key distri- 
bution secure against coherent attacks with memoryless 
measurement devices. New J. Physics 11, 103037 (2009) 
; M. McKague, |arXiv:1006.2"352l 



[4] A. Acin, S. Massar, S. Pironio, Efficient quantum key 
distribution secure against no-signalling eavesdroppers. 
New J. Phys. 8, 126 (2006). 

[5] P. Michler et al, Science 290, 2282 (2000); C. Santori et 
al, Phys. Rev. Lett. 86, 1502 (2001). 

[6] E. Moreau et al, Appl. Phys. Lett. 79, 2865 (2001); M. 
Pelton et al, Phys. Rev. Lett. 89, 233602 (2002). 

[7] J.C. McKeever et al. Science 303, 1992 (2004) ; M. Hi- 
jlkema et al. Nature Physics 3, 253 (2007). 

[8] C.K. Hong, Z.Y. On, and L. Mandel, Measurement of 
subpicosecond time intervals between two photons by in- 
terference, Phys. Rev. Lett. 59, 2044 (1987). 

[9] T.B. Pittman and J.D. Franson, Violation of Bell's in- 
equality with photons from independent sources, Phys. 
Rev. Lett. 90, 240401 (2003). 
[10] Indeed, I[S, fj,) is an intrinsic property of the devices; it 
represents an information theoretic bound on the infor- 
mation of Eve when the boxes output a single photon. 
[11] Note that we checked that the optimal values for p and p' 
are such that the terms that we leave at the order o(p^), 
o(p'^), o{p^p') and o{pp'^) are negligible. 



